Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.4
CVE-2026-111636: OpenBMB StaffDeck 0.5.6 allows admin login bypass
CVE-2026-111636 · published 19 days ago
Summary
OpenBMB StaffDeck versions up through 0.5.6 use a fixed secret value that can be guessed, letting anyone create a fake administrator session and take control of the system. This could let an attacker change or steal model and channel credentials. Update to the latest version or apply the vendor’s patch and replace any default secrets with your own unique values.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| openbmb | staffdeck | <= 0.5.6 |
Original advisory text
OpenBMB StaffDeck through 0.5.6 Authentication Bypass via Hard-Coded Session Secret
OpenBMB StaffDeck through 0.5.6 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator session tokens using the hard-coded default app_secret. Attackers can sign an HMAC-SHA256 token for the seeded 'admin' user in 'tenant_demo' to gain full tenant administration, including stored model and channel credentials.
References
- https://github.com/OpenBMB/StaffDeck/blob/v0.5.6/backend/app/config.py#L10 Third Party Advisory
- https://github.com/OpenBMB/StaffDeck/blob/v0.5.6/backend/app/security/auth.py#L9... Third Party Advisory
- https://hackmd.io/@hieuPenguinnn/staffdeck-default-token-signing-secret-auth-byp... Vendor Advisory
- https://www.vulncheck.com/advisories/openbmb-staffdeck-through-0.5.6-authenticat... Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-1116... Vendor Advisory
- https://github.com/OpenBMB/StaffDeck Product
- https://nvd.nist.gov/vuln/detail/CVE-2026-111636 Vendor Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Severity
9.4
Critical
Type
CWE-321Use of Hard-coded Cryptographic Key
Timeline
Published16 Oct 2026
Updated4 Nov 2026
First seen16 Oct 2026
Track software like this
Free during beta